Oracle Agile EDM CVE-2026-101741

Exploitation requires the attacker to have access to the physical communication segment attached to the hardware where Oracle Agile Engineering Data Management 6.2.1 executes (adjacent network, AV:A) and to interact with the Engineering Communication Interface component; no credentials are needed (PR:N) and no user interaction is required (UI:N). The significant limiting factors are the adjacency requirement (an attacker on the public Internet cannot reach it) and high attack complexity (AC:H), indicating the attacker must satisfy timing or configuration conditions outside their direct control. Impact is limited to confidentiality (C:H) - unauthorized read of critical data - with no integrity or availability effect.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) whose real-world risk is substantially lower than the confidentiality-only 'C:H' impact might suggest, because the exploitation preconditions are demanding. The vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N requires an adjacent-network position - specifically access to the physical communication segment attached to the host - combined with high attack complexity (AC:H), meaning the attacker must win a race or satisfy conditions outside their control. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code was supplied, so exploitation status is 'no public exploit identified at time of analysis.' There is a signal conflict worth flagging: the input Tags include 'Authentication Bypass,' but the Oracle description characterizes this as unauthorized read access to critical data via an adjacent-network attacker, not as a bypass of an authentication control - treat the 'Authentication Bypass' tag as unverified. Overall this is a genuine but low-urgency issue: patch in the normal Oracle CPU cycle rather than as an emergency, given AV:A + AC:H and no evidence of exploitation.

An attacker who has already gained a foothold on the same physical/adjacent network segment as the Oracle Agile Engineering Data Management server intercepts or manipulates traffic to the Engineering Communication Interface under favorable timing conditions, extracting critical engineering data without authenticating. The adjacent-vector (AV:A) and high-complexity (AC:H) requirements mean the attacker needs local network proximity and must satisfy conditions not fully under their control. No public proof-of-concept was provided in the intelligence sources.